2.1 Methodological Framework for Examining CNIL Administrative Sanctions and Formal Notices
The methodological architecture of this study adopts a dual doctrinal-empirical design to evaluate the supervisory activity of the Commission Nationale de l'Informatique et des Libertés (CNIL). Traditional doctrinal analysis scrutinises primary statutory norms, European Union data protection principles, and jurisprudential interpretations rendered by administrative jurisdictions and the Court of Justice of the European Union (CJEU 2020). However, normative analysis alone cannot capture the practical enforcement dynamics and regulatory choices made by independent administrative authorities. Therefore, the doctrinal inquiry is systematically coupled with empirical documentary analysis of formal notices (mises en demeure) and administrative sanction decisions published by the CNIL (CNIL 2024). The corpus assembly follows defined selection parameters focused on high-risk sectors processing sensitive or vulnerable user data, notably digital health platforms and educational technology infrastructures. In evaluating these administrative records, the research assesses the application of sectoral supervisory criteria, such as big data processing governance in healthcare ecosystems (CNIL and Analysis of Big Data Projects in the Health Sector 2020) and technical telemetry enforcement involving cross-border tracking mechanisms (CNIL 2022). Each administrative instrument is indexed and coded according to legal bases, identified breach typologies under the General Data Protection Regulation, proportionality assessments, and the severity of imposed corrective measures. This integrated framework ensures that doctrinal interpretations are grounded directly in the observed regulatory practice of the French supervisory authority.